是否有可能使用卡夫卡与docker组成一个单一的主机，而不暴露动物园pipe理员和卡夫卡端口到公共互联网？

我有一个docker-compose.yml文件，看起来像这样：

version: '3' services: zookeeper: container_name: zookeeper image: wurstmeister/zookeeper ports: - "2181:2181" networks: - privatenetwork kafka: depends_on: - zookeeper container_name: kafka image: wurstmeister/kafka ports: - "9092:9029" environment: - KAFKA_ADVERTISED_HOST_NAME=${HOST_IP} - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181 volumes: - /var/run/docker.sock:/var/run/docker.sock 

我想避免使用“expose”configuration属性转发kafka和zookeeper端口到主机，以便我的docker-compose文件如下所示：

 version: '3' services: zookeeper: container_name: zookeeper image: wurstmeister/zookeeper expose: - "2181" networks: - privatenetwork kafka: depends_on: - zookeeper container_name: kafka image: wurstmeister/kafka expose: - "9092" environment: - KAFKA_ADVERTISED_HOST_NAME=${HOST_IP} - KAFKA_ZOOKEEPER_CONNECT=zookeeper:2181 volumes: - /var/run/docker.sock:/var/run/docker.sock 

我想阻止与卡夫卡和动物园pipe理员的外部交stream。 这是可能与docker撰写，或者我需要closures主机上的端口使用防火墙？